feat: replace Kaniko with buildah for container builds

- Switch from archived Kaniko to actively maintained buildah
- Use buildah from Alpine repos (no manual binary downloads)
- Replace bash syntax with POSIX sh (case instead of [[ ]])
- buildah works better in unprivileged containerized environments
- Simpler setup: just apk add buildah, no extra configuration

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/workflows/build.yaml

@@ -15,13 +15,7 @@ jobs:
       - name: Install dependencies
         shell: sh
         run: |
-          apk add --no-cache git wget ca-certificates
+          apk add --no-cache git buildah fuse-overlayfs
-
-      - name: Install Kaniko
-        shell: sh
-        run: |
-          wget -O /usr/local/bin/executor https://github.com/GoogleContainerTools/kaniko/releases/download/v1.23.2/executor-linux-amd64
-          chmod +x /usr/local/bin/executor
 
       - name: Checkout code
         shell: sh
@@ -48,54 +42,47 @@ jobs:
           IMAGE_BASE="${REGISTRY}/${REPO_OWNER_LOWER}/${REPO_NAME_LOWER}"
 
           # Determine tag based on ref
-          if [[ "${{ gitea.ref }}" == refs/tags/* ]]; then
+          case "${{ gitea.ref }}" in
-            # Tag push - use the tag name
+            refs/tags/*)
-            TAG_NAME="${{ gitea.ref_name }}"
+              # Tag push - use the tag name
-            echo "IMAGE_TAG=${IMAGE_BASE}:${TAG_NAME}" >> $GITHUB_OUTPUT
+              TAG_NAME="${{ gitea.ref_name }}"
-            echo "PUSH_LATEST=true" >> $GITHUB_OUTPUT
+              echo "IMAGE_TAG=${IMAGE_BASE}:${TAG_NAME}" >> $GITHUB_OUTPUT
-          elif [[ "${{ gitea.ref_name }}" == "main" ]]; then
+              echo "PUSH_LATEST=true" >> $GITHUB_OUTPUT
-            # Main branch - use commit SHA (shortened to 7 chars) and latest
+              ;;
-            SHORT_SHA=$(echo "${{ gitea.sha }}" | cut -c1-7)
+            refs/heads/main)
-            echo "IMAGE_TAG=${IMAGE_BASE}:${SHORT_SHA}" >> $GITHUB_OUTPUT
+              # Main branch - use commit SHA (shortened to 7 chars) and latest
-            echo "PUSH_LATEST=true" >> $GITHUB_OUTPUT
+              SHORT_SHA=$(echo "${{ gitea.sha }}" | cut -c1-7)
-          else
+              echo "IMAGE_TAG=${IMAGE_BASE}:${SHORT_SHA}" >> $GITHUB_OUTPUT
-            # Other branches - use branch name
+              echo "PUSH_LATEST=true" >> $GITHUB_OUTPUT
-            BRANCH_TAG=$(echo "${{ gitea.ref_name }}" | sed 's/\//-/g')
+              ;;
-            echo "IMAGE_TAG=${IMAGE_BASE}:${BRANCH_TAG}" >> $GITHUB_OUTPUT
+            *)
-            echo "PUSH_LATEST=false" >> $GITHUB_OUTPUT
+              # Other branches - use branch name
-          fi
+              BRANCH_TAG=$(echo "${{ gitea.ref_name }}" | sed 's/\//-/g')
+              echo "IMAGE_TAG=${IMAGE_BASE}:${BRANCH_TAG}" >> $GITHUB_OUTPUT
+              echo "PUSH_LATEST=false" >> $GITHUB_OUTPUT
+              ;;
+          esac
 
           echo "IMAGE_LATEST=${IMAGE_BASE}:latest" >> $GITHUB_OUTPUT
 
-      - name: Setup Kaniko config
+      - name: Login to registry
         shell: sh
         run: |
-          mkdir -p /kaniko/.docker
+          echo "${{ secrets.PERSONAL_TOKEN }}" | buildah login --username "${{ gitea.actor }}" --password-stdin gitea.leeworks.dev
-          cat > /kaniko/.docker/config.json <<EOF
-          {
-            "auths": {
-              "gitea.leeworks.dev": {
-                "auth": "$(echo -n "${{ gitea.actor }}:${{ secrets.PERSONAL_TOKEN }}" | base64)"
-              }
-            }
-          }
-          EOF
 
-      - name: Build and push with Kaniko
+      - name: Build and push with buildah
         shell: sh
         run: |
-          echo "Building and pushing image with Kaniko..."
+          echo "Building image with buildah..."
-          if [[ "${{ steps.tags.outputs.PUSH_LATEST }}" == "true" ]]; then
+          buildah bud -t ${{ steps.tags.outputs.IMAGE_TAG }} .
-            /usr/local/bin/executor \
+
-              --context=/workspace/${{ gitea.repository }} \
+          echo "Pushing image..."
-              --dockerfile=Dockerfile \
+          buildah push ${{ steps.tags.outputs.IMAGE_TAG }}
-              --destination=${{ steps.tags.outputs.IMAGE_TAG }} \
+
-              --destination=${{ steps.tags.outputs.IMAGE_LATEST }}
+          if [ "${{ steps.tags.outputs.PUSH_LATEST }}" = "true" ]; then
-          else
+            echo "Tagging and pushing latest..."
-            /usr/local/bin/executor \
+            buildah tag ${{ steps.tags.outputs.IMAGE_TAG }} ${{ steps.tags.outputs.IMAGE_LATEST }}
-              --context=/workspace/${{ gitea.repository }} \
+            buildah push ${{ steps.tags.outputs.IMAGE_LATEST }}
-              --dockerfile=Dockerfile \
-              --destination=${{ steps.tags.outputs.IMAGE_TAG }}
           fi
 
           echo "Build and push completed successfully!"